Subresource Integrity (SRI).

Subresource Integrity, standardised as a W3C Recommendation in 2016, is configured with an integrity attribute on script or link tags containing one or more base64-encoded SHA-256/384/512 digests of the expected file. The browser fetches the resource, recomputes the digest and refuses to execute or apply it if no listed hash matches; multiple space-separated hashes let a page accept several known-good versions. Because SRI requires knowing the exact bytes in advance, it protects static, version-pinned assets rather than dynamically generated ones.

SRI is the primary client-side defence against CDN compromise and hijacked third-party scripts such as the Magecart family. The Polyfill.io attack shows why it matters: after a new owner acquired the cdn.polyfill.io domain in February 2024, the CDN began serving payloads that redirected mobile users to scam sites — discovered by Sansec on 25 June 2024 and affecting over 100,000 sites (tracked as CVE-2024-38526). Any page that had pinned an integrity hash would have blocked the mutated file outright, because the digest no longer matched.

SRI works alongside CSP and the crossorigin attribute, and should be combined with version pinning and automated hash-regeneration in the build pipeline so code and digest never drift apart.

flowchart TD
  A["Browser parses tag<br/>with integrity attribute"] --> B[Fetch resource from CDN]
  B --> C[Compute SHA-256/384/512 digest]
  C --> D{Digest matches a<br/>listed hash?}
  D -->|Yes| E[Execute / apply resource]
  D -->|No — tampered or swapped| F[Block and raise error]